Commit f01df197 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

checkconnection: don't call with NULL pointer 

When checking if an existing RTSP connection is alive or not, the
checkconnection function might be called with a SessionHandle pointer
being NULL and then referenced causing a crash. This happened only using
the multi interface.

Reported by: Tinus van den Berg

Bug: http://curl.haxx.se/bug/view.cgi?id=3280739
parent b2e06ea1

lib/connect.c

+3 −0
Original line number Diff line number Diff line
@@ -1122,6 +1122,9 @@ curl_socket_t Curl_getconnectinfo(struct SessionHandle *data, 
                                  struct connectdata **connp)

{

  curl_socket_t sockfd;



  DEBUGASSERT(data);



  if((data->state.lastconnect != -1) &&

     (data->state.connc->connects[data->state.lastconnect] != NULL)) {

    struct connectdata *c =

lib/rtsp.c

+4 −4
Original line number Diff line number Diff line
@@ -124,10 +124,10 @@ bool Curl_rtsp_connisdead(struct connectdata *check) 
    /* socket is in an error state */

    ret_val = TRUE;

  }

  else if (sval & CURL_CSELECT_IN) {

    /* readable with no error. could be closed or could be alive */

    curl_socket_t connectinfo =

      Curl_getconnectinfo(check->data, &check);

  else if ((sval & CURL_CSELECT_IN) && check->data) {

    /* readable with no error. could be closed or could be alive but we can

       only check if we have a proper SessionHandle for the connection */

    curl_socket_t connectinfo = Curl_getconnectinfo(check->data, &check);

    if(connectinfo != CURL_SOCKET_BAD)

      ret_val = FALSE;

  }